50 Free CompTIA CySA+ Practice Questions (CS0-003)

Preparing for the CompTIA CySA+? These free questions cover the CS0-003 exam domains.

---

Domain 1: Security Operations (Questions 1–17)

Question 1

Which SIEM component collects and normalizes log data from multiple sources?

a) Correlation engine
b) Data aggregator/collector
c) Dashboard
d) Alert manager

Show Answer

Answer: b) Data aggregator/collector

Explanation: Data collectors/aggregators ingest logs from various sources, normalize them to a common format, and forward them to the SIEM analytics engine.

Question 2

What is the MITRE ATT&CK framework used for?

a) Penetration testing methodology
b) Knowledge base of adversary tactics and techniques
c) Vulnerability scoring
d) Compliance auditing

Show Answer

Answer: b) Knowledge base of adversary tactics and techniques

Explanation: MITRE ATT&CK categorizes real-world adversary behaviors into tactics (goals) and techniques (methods). It's used for threat modeling, detection, and response.

Question 3

What is the primary difference between SOAR and SIEM?

a) SIEM detects; SOAR automates response
b) SOAR detects; SIEM automates
c) They are the same
d) SIEM is for cloud only

Show Answer

Answer: a) SIEM detects; SOAR automates response

Explanation: SIEM collects and analyzes security data. SOAR (Security Orchestration, Automation, and Response) automates incident response workflows playbooks.

Questions 4–17

[Full set covers threat hunting, threat intelligence, SOC processes, data sources, and log analysis]

---

Domain 2: Vulnerability Management (Questions 18–31)

Question 4

Which CVSS metric describes the complexity of an attack?

a) Attack Vector
b) Attack Complexity
c) Privileges Required
d) User Interaction

Show Answer

Answer: b) Attack Complexity

Explanation: Attack Complexity measures conditions beyond the attacker's control (e.g., High = special conditions required, Low = no special conditions).

Question 5

What is false positive in vulnerability scanning?

a) A vulnerability that exists but the scanner missed it
b) A finding that doesn't actually exist
c) A correctly identified vulnerability
d) A critical vulnerability

Show Answer

Answer: b) A finding that doesn't actually exist

Explanation: False positive = scanner reports a vulnerability that isn't real. False negative = scanner misses an actual vulnerability.

Questions 6–31

[Full set covers scanning methodologies, CVSS, prioritization, patch management, and compensating controls]

---

Domain 3: Incident Response (Questions 32–44)

Question 6

What is the first step in the NIST incident response lifecycle?

a) Detection
b) Preparation
c) Containment
d) Recovery

Show Answer

Answer: b) Preparation

Explanation: NIST SP 800-61: 1) Preparation, 2) Detection & Analysis, 3) Containment/Eradication/Recovery, 4) Post-Incident Activity.

Question 7

Which evidence type is most volatile and should be collected first?

a) Disk drives
b) Memory (RAM)
c) Network logs
d) Backup tapes

Show Answer

Answer: b) Memory (RAM)

Explanation: Order of volatility: CPU/registers → RAM → network connections → swap → disk → tapes. RAM contents are lost immediately upon power loss.

Questions 8–44

[Full set covers forensic acquisition, chain of custody, malware analysis, containment strategies, and eradication]

---

Domain 4: Reporting and Communication (Questions 45–50)

Question 8

What should a vulnerability report include?

a) Only technical details
b) Executive summary, findings, risk ratings, remediation recommendations
c) Only risk scores
d) Only affected systems

Show Answer

Answer: b) Executive summary, findings, risk ratings, remediation recommendations

Explanation: Effective reports communicate to both technical teams (details) and management (business impact, risk, priorities).

Questions 9–50

[Full set covers communication strategies, report formats, stakeholder management, and compliance reporting]

---

How Did You Score?

Access all CySA+ practice questions →